Securing u-boot: allow only authentic images

Hi there,

I'm new to u-boot and in need for a little assistance, I hope someone can point me in the right direction.

I need to secure the bootloader of a device to some extend. The device is currently using u-boot as bootloader and I would like to stick with that.

The device runs an OpenWRT. The SoC is a HLK7628N.

At this moment, it is possible to use the u-boot bootloader to replace the image of the device with any other image. I would like to have u-boot to allow only authentic (signed?) images. What is the best way to accomplish this? Any pointers, examples and so on will be much appreciated.

Thanks!